BIND, dynamic DNS
Contents |
The task
You've got your own BIND server with a static, public IP address, and your own domain which you host on it. You've also got one or more machines on dynamic public IP addresses - perhaps your or your customers' or friends' home machines, or small offices in areas that don't offer static addresses - and you want to use your own equipment to maintain DNS records to point to the machines on dynamic addresses, rather than using third-party solutions.
Checking versions of BIND and its tools
In order to set up dynamic DNS on your server, first you need to make sure you're running BIND9 or better - as of this article, you want BIND 9.3.1.
server# which named /usr/sbin/named server# named -v BIND 9.3.1
client# which named /usr/sbin/named client# named -v BIND 9.3.1
Okay, good. But we also need to dig a little further, because FreeBSD systems have a nasty habit of shipping with some elderly BIND8 components higher up in the PATH than the newer BIND9 versions that go with the actual server. Specifically, we need to make sure we're using the new version of nsupdate, which we'll be using to do the dynamic updates from client to server:
client# where nsupdate /usr/sbin/nsupdate /usr/bin/nsupdate
Aha - there are two copies of nsupdate on this machine! Now we need to see which one of them is higher up in the PATH (and therefore will be the one that runs if you don't specify which one you want), and whether they're both the same version or not:
client# which nsupdate /usr/sbin/nsupdate client# ls -l /usr/bin/nsupdate && ls -l /usr/sbin/nsupdate -r-xr-xr-x 1 root wheel 1252248 May 8 2005 /usr/bin/nsupdate -r-xr-xr-x 1 root wheel 245324 Jul 5 2004 /usr/sbin/nsupdate
AHA! As we suspected, there's a copy of the nsupdate from BIND8 lurking in our PATH higher up than the BIND9 version - and BIND8's nsupdate tool was completely broken and useless. So, we'll get rid of it. (Obviously, if you don't have an older version in the way, you don't need to do this step - but it's important to check and make sure, because you'll be tearing your hair out later wondering why everything looks like it's working but isn't if you have this problem but don't catch it.)
client# rm /usr/sbin/nsupdate
With that taken care of, we can start working on the subdomain we want to dynamically update. In this example, we're going to use a (fictitious) parent zone, server.net, which is maintained by a statically-addressed FreeBSD server which we have (root) control of, and we already have functional DNS for the parent zone.
Preparing a "seed" zone file
First, we need to prepare a "seed" zone file for the subdomain we want to be able to dynamically update. In this example, our dynamic subdomain is going to be client.server.net. This zone file should be very minimal - we only want to put the barest amount of information in here, to define those parts of the domain that WON'T ever change. In this case, that will be the SOA record, the NS records, and the MX record. (Since MX records are based on A records, not on IP addresses, the MX record won't change even when the IP address of the mailserver itself does).
$ORIGIN .
$TTL 10 ; 10 seconds
client.server.net IN SOA ns1.server.net. hostmaster.server.net. (
18 ; serial
10800 ; refresh (3 hours)
3600 ; retry (1 hour)
604800 ; expire (1 week)
10 ; minimum (10 seconds)
)
$TTL 3600 ; 1 hour
NS ns1.server.net.
NS ns2.server.net.
MX 10 client.server.net.
$ORIGIN client.server.net.
Generating a cryptographic key
While it's possible to allow zone updates without any cryptographic security, it's certainly not recommended - and implementing the crypto isn't difficult, anyway, so let's get to it. We're storing our zones in /etc/namedb/zones, and we'll park our key(s) in /etc/namedb/zones/keys.
server# mkdir /etc/namedb/zones/keys server# cd /etc/namedb/zones/keys server# dnssec-keygen -b 512 -a HMAC-MD5 -v 2 -n HOST client.server.net. Kclient.server.net.+157+15661 server# ls -l -rw------- 1 root wheel 134 May 20 19:46 Kclient.server.net.+157+15661.key -rw------- 1 root wheel 145 May 20 19:46 Kclient.server.net.+157+15661.private
And there they are - one public key, one private key. The next step is incorporating them into the named.conf file.
Setting up named.conf
First, we need to pluck the actual value of the private key out of its file to insert it directly into the zone definition.
server# cat /etc/namedb/zones/keys/Kclient.server.net.+157+15661.private Private-key-format: v1.2 Algorithm: 157 (HMAC_MD5) Key: omr5O5so/tZB5XeGuBBf42rrRJRQZB8I9f+uIIxxei8qm7AVgNBprxtcU+FQMzBvU/Y+nyM2xbs/C8kF3eJQUA==
That last bit of the private key is what we need. So, we copy and paste it into the new zone definition and key reference we're appending to /etc/namedb/named.conf:
key client.server.net. {
algorithm "HMAC-MD5";
secret "omr5O5so/tZB5XeGuBBf42rrRJRQZB8I9f+uIIxxei8qm7AVgNBprxtcU+FQMzBvU/Y+nyM2xbs/C8kF3eJQUA==";
};
zone "client.server.net" {
type master;
file "zones/client.server.net";
allow-update{
key client.server.net;
};
};
Now that we have the keys set up, we need to make sure nobody can read them, either in their original directory or in the line we just added to named.conf with the value of the private key:
server# chmod -R 400 /etc/namedb/zones/keys; server# chmod -R 400 /etc/namedb/named.conf;
And we're done. If you like, you may also chmod 400 /etc/namedb/zones, but it's not strictly necessary since everything in there is available by normal DNS query from the internet anyway. The only thing left to do on the server side is restart named and make sure it still works!
Restarting and testing BIND at the server
#server ps ax | grep named 76949 ?? Ss 0:01.03 named #server kill 76949 #server named #server ps ax | grep named 81230 ?? Ss 0:00.49 named
Ok, we've found and killed our previous instance of BIND (don't just use -HUP - you need to kill it all the way), then gotten it back up and confirmed it's running. Now let's see if it responds properly when we ask it about the new zone:
#server dig @localhost client.server.net ; <<>> DiG 9.3.1 <<>> @localhost ANY client.server.net ; (1 server found) ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 13783 ;; flags: qr aa ... \n == The Way of the Peaceful Parent == The Way is only learned by walking it. Here are the steps I recommend:* Greet your child each morning with a smile, a hug, a loving Good Morning! This is how we would all like to be greeted each day. [[http://goodvillenews.com/The-Way-of-the-Peaceful-Parent-sdV8KN.html The Way of the Peaceful Parent]] [[http://goodvillenews.com/wk.html GoodvilleNews.com - good, positive news, inspirational stories, articles]] == What Is Your Legacy? Living A Meaningful life == I want the world to be better because I was here. I want my life, I want my work, my family, I want it to mean something and if you are not making someone elses life better then you are wasting your time Will Smith [[http://goodvillenews.com/What-Is-Your-Legacy-Living-A-Meaningful-life-oBtnrB.html What Is Your Legacy? Living A Meaningful life]] [[http://goodvillenews.com/wk.html GoodvilleNews.com - good, positive news, inspirational stories, articles]] == Microbial Oasis Discovered Beneath the Atacama Desert == Two metres below the surface of the Atacama Desert there is an oasis of microorganisms. Researchers from the Center of Astrobiology (Spain) and the Catholic University of the North in Chile have found it in hypersaline substrates thanks to SOLID, a detector for signs of life which could be used in environments similar to subsoil on Mars. [[http://goodvillenews.com/Microbial-Oasis-Discovered-Beneath-the-Atacama-Desert-WWstX4.html Microbial Oasis Discovered Beneath the Atacama Desert]] [[http://goodvillenews.com/wk.html GoodvilleNews.com - good, positive news, inspirational stories, articles]] == Learning from the Wisdom of the Body == "Its amazing that our interpretation of experiences can generate intense visceral responses. The fact that we get goosebumps when we are inspired or afraid is one of many everyday indicators of just how deeply and intricately connected our minds and bodies are. In fact, the mind and body are an intertwined whole -- and there is great wisdom in the totality of our mind-body experience. [[http://goodvillenews.com/Learning-from-the-Wisdom-of-the-Body-lJQFSo.html Learning from the Wisdom of the Body]] [[http://goodvillenews.com/wk.html GoodvilleNews.com - good, positive news, inspirational stories, articles]] == 7 Essential Books on Optimism == Every once in a while, we all get burned out. Sometimes, charred. And while a healthy dose of cynicism and skepticism may help us get by, its in those times that we need nothing more than to embrace lifes promise of positivity with open arms. Here are seven wonderful books that help do just that with an arsenal ranging from the light visceral stimulation of optimistic design to the serious neuroscience findings about our proclivity for the positive. [[http://goodvillenews.com/7-Essential-Books-on-Optimism-6pgcLt.html 7 Essential Books on Optimism]] [[http://goodvillenews.com/wk.html GoodvilleNews.com - good, positive news, inspirational stories, articles]]
